A third party is any person or organisation other than the data subject or data controller. This includes parents, family members, friends and offical agencies. Personal data should not be disclosed to any third party without the consent of the data subject or unless a condition or exemption within the Data Protection Act applies.
If representatives of any of the following types of organisation contact you asking for personal information of current or past students or staff, but do not have the written consent of the individual concerned, please put them in touch with the Information Governance Manager at data-protection@bristol.ac.uk:
It is important to follow proper procedures to ensure the enquiry is genuine, and that any disclosure of information would be lawful. Professional and legitimate enquirers are usually polite and should not object to following formal procedures.
Urgent out of hours enquiries from the Police should be passed to Security Services.
